2019-05-02 UTC
# 
sknebel GWG: I'd assume something along the lines of "IndieAuth is older than really widespread availability of HTTPS", and think it makes sense for it to be a choice for individual use cases. E.g. with a micropub client, the user is the one making the choice to run it despite not having TLS - an attacker gains little from tricking a micropub client into believing they're someone else. For a service signup, that's different